T8943: migrate mirror wrapper to App-ready uniform stub (rollout 1b Task 5)

[andamasov]

Summary

Rollout 1b (mirror pipeline PAT→App migration), Task 5. Switches this repo's mirror wrapper from explicit secrets: PAT/REMOTE_OWNER pass-through to secrets: inherit and adopts the uniform stub (incl. vars.MIRROR_ENABLED per-repo kill-switch, default-on). Behavior-neutral against the current PAT-using central workflow. Prepares for the App-token central-workflow update (Task 7).

• Plan: ~/.claude/plans/2026-05-26-mirror-rollout-1b-revised.md Task 5
• Tracking: T8943

🤖 Generated by robots

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 09eab657-6f77-477a-bf47-95a97cc9483f

📥 Commits

Reviewing files that changed from the base of the PR and between 7ba9fbd and a3407e6.

📒 Files selected for processing (1)

• .github/workflows/pr-mirror-repo-sync.yml

---

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Updated repository synchronization workflow to improve automation and secret handling. Inputs were simplified and branch selection is now required with a sensible fallback to the PR base branch. Triggers were clarified so sync runs after merged pull requests or via manual dispatch. Secret passing was streamlined to use inherited secrets for safer, centralized management.

Walkthrough

Single-file workflow update adds governance marker, simplifies workflow_dispatch to required sync_branch, renames the job to call, refines the trigger conditional to include merged PRs or manual dispatch, and switches secret passing to secrets: inherit (see .github/workflows/pr-mirror-repo-sync.yml, lines 1-30).

Changes

PR Mirror Repo Sync Workflow Update

Layer / File(s)	Summary
Workflow metadata and input schema .github/workflows/pr-mirror-repo-sync.yml (lines 1-20)	Adds DO NOT EDIT managed-header comment (lines 1-5) and converts workflow_dispatch input to a required sync_branch string without description/default/options; reorders permissions block (lines 6-20).
Job execution logic and secrets wiring .github/workflows/pr-mirror-repo-sync.yml (lines 21-30)	Renames job to call, rewrites if conditional to trigger on github.event.pull_request.merged == true or workflow_dispatch and vars.MIRROR_ENABLED != 'false', uses inputs.sync_branch with PR base ref fallback for with.sync_branch, and replaces explicit PAT/REMOTE_OWNER secret inputs with secrets: inherit (lines 21-30).

Possibly related PRs

• vyos/vyos-infrastructure#9: Introduced the initial pr-mirror-repo-sync.yml workflow that this PR refactors.

✨ Finishing Touches

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch feature/rollout-1-wrapper-migration

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}